Unpatched RCE Found in Code Runner MCP Server
CVE-2026-5029 lets unauthenticated attackers execute arbitrary code on Code Runner MCP Server instances running with HTTP transport, and no fix exists.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-5029, a remote code execution vulnerability in the Code Runner MCP Server. When the server is launched with the --transport http option, it exposes an unauthenticated JSON-RPC endpoint (/mcp) on port 3088. Attackers can invoke the server's run-code tool to submit arbitrary source code, which is executed via child_process.exec() using the specified language interpreter, granting code execution with the privileges of the server process.
The vulnerability affects all versions of the project and has not been patched at time of disclosure. Given that MCP (Model Context Protocol) servers are increasingly deployed to support AI-agent tooling and often exposed for integration purposes, unauthenticated instances running HTTP transport are directly exploitable with no user interaction required. No evidence of active in-the-wild exploitation was reported; the advisory represents a coordinated disclosure rather than confirmation of ongoing attacks. Operators are advised to avoid exposing the HTTP transport without authentication controls until an upstream fix is available.
Mentioned in this report
Detection guidance
Code Runner MCP Server Exposed HTTP Transport
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Code Runner MCP Server process launched with --transport http flag, exposing unauthenticated RCE endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Code Runner MCP Server Exposed HTTP Transport
description: Detects Code Runner MCP Server launched with --transport http, which
exposes an unauthenticated JSON-RPC endpoint vulnerable to remote code execution
(CVE-2026-5029).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- code-runner
- --transport
- http
condition: selection
falsepositives:
- Legitimate development environments intentionally running MCP server on HTTP for
local testing
- Authorized internal tooling configured with HTTP transport behind network segmentation
level: high
id: 8811f21c-f55f-55a6-9992-527bca1d311d
status: experimental
author: Vorant
Suspicious Child Process Execution from Code Runner MCP Server
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects child_process.exec() spawning interpreters (python, node, ruby, bash, etc.) from Code Runner MCP Server process, indicating code execution via the vulnerable run-code tool. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Execution from Code Runner MCP Server
description: Detects language interpreters and shells spawned as children of Code
Runner MCP Server process, consistent with exploitation of the run-code tool via
CVE-2026-5029.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: code-runner
selection_child:
Image|endswith:
- \\python.exe
- \\python3.exe
- \\node.exe
- \\ruby.exe
- \\perl.exe
- \\bash.exe
- \\cmd.exe
- \\powershell.exe
- \\java.exe
- \\php.exe
filter_benign:
ParentCommandLine|contains:
- test
- dev
condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Legitimate MCP server instances running authorized code evaluation in sandboxed
development environments
- Build or automation systems intentionally using Code Runner MCP as a local task
executor
level: medium
id: e0ce5947-6857-58ed-90c0-cb33a91352f8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-5029
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs